What is GHSA-3qh4-r86r-grvm?

GHSA-3qh4-r86r-grvm is a security advisory published by GitHub Security Advisories with High severity. Arbitrary JavaScript Execution in typed-function

Which CVE IDs does GHSA-3qh4-r86r-grvm cover?

GHSA-3qh4-r86r-grvm covers the following CVE IDs: CVE-2017-1001004. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-3qh4-r86r-grvm?

GHSA-3qh4-r86r-grvm affects 1 product, including: npm/typed-function:\u003c 0.10.6.

GHSA-3qh4-r86r-grvmHigh

Arbitrary JavaScript Execution in typed-function

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2017-1001004 →

📋 Description

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.

Recommendation

Upgrade to version 0.10.6 or later.

🎯 Affected products1

npm/typed-function:< 0.10.6

🔗 References (7)

https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe?diff=split#diff-9e1f22c2954a38db1fdf444dbc74e0a8
https://snyk.io/vuln/SNYK-JS-TYPEDFUNCTION-174139
https://www.npmjs.com/advisories/819
https://nvd.nist.gov/vuln/detail/CVE-2017-1001004
https://github.com/josdejong/typed-function/commit/6478ef4f2c3f3c2d9f2c820e2db4b4ba3425e6fe
https://github.com/josdejong/typed-function/blob/master/HISTORY.md#2017-11-18-version-0106
https://github.com/advisories/GHSA-3qh4-r86r-grvm